iOS Configuration Profile Validation via Root Certificate
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile device management solutions exert excessive control over personal devices, making employees reluctant to use them, and alternative approaches cannot leverage configuration profile capabilities to ensure security settings are implemented for workspace environments.
Innovation Solution
A mobile device application validates the presence of a configuration profile by receiving a digital certificate from a server, confirming it is trusted by the operating system, and ensuring security settings are enforced for business-related applications, including VPN settings, by embedding and signing certificates within the profile.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional MDM servers are used to impose security measures on personal mobile devices, then security control over enterprise data is improved, but device control complexity and user autonomy deteriorate due to heavy-handed remote lock and device wipe capabilities
Solution Approach 1:
The patent segments device control into two distinct layers: configuration profile management for security settings and workspace application management. The MDM server only manages configuration profiles rather than having direct control over workspace applications, creating a clear separation between security enforcement and application functionality. This segmentation reduces control complexity while maintaining security reliability.
Solution Approach 2:
The patent extracts the configuration profile validation capability from the MDM server and places it within the mobile device's operating system. The OS independently validates configuration profiles and enforces security settings without requiring continuous MDM server intervention, thereby reducing the complexity of remote control mechanisms while preserving security control.
2Device complexity
If alternative local management applications are used to reduce control complexity, then user autonomy is improved, but the ability to validate configuration profiles and ensure security settings are implemented deteriorates
Solution Approach 1:
The patent merges the configuration profile validation functionality with the operating system's native configuration profile processing capabilities. The OS uses its existing mechanisms to load and validate configuration profiles, then the local management application leverages these validated profiles to enforce security settings. This merging allows local applications to validate configurations without adding complex validation mechanisms.
Solution Approach 2:
The operating system acts as an intermediary between the MDM server and the local management application. The OS receives configuration profiles from the MDM server, validates them using its native capabilities, and then the local management application can reliably enforce security settings based on these validated profiles. This intermediary role enables precise configuration validation without requiring the local application to implement complex validation logic.
3Ease of operation
If configuration profiles are made removable to allow user flexibility, then ease of operation is improved, but security reliability deteriorates due to potential malicious modifications or removal of security settings
Solution Approach 1:
The patent implements preliminary validation of configuration profiles by the operating system before they are enforced by the local management application. The OS validates the configuration profile's integrity and authenticity before allowing it to be applied, preventing malicious modifications. This preliminary action ensures security reliability is maintained even when users have flexibility to manage their devices.
Data Source
AI summary
An application management agent running on a wireless communications device restricts access to device functionality (e.g., applications and device features) unless the application management agent has determined that a particular configuration profile has been installed on the device (after which the application management agent permits access to device functionality, and an operating system of the device enforces policy settings specified in the configuration profile). The application management agent confirms the presence of the configuration profile by using a validation certificate to validate against a root certificate embedded in a configuration profile installed on the device. The configuration profile is configured to be non-removable, so it cannot be remove or updated, except by another configuration profile signed by the same authority. Validation against the embedded root certificate thereby implicitly confirms the presence of the configuration profile and validates the content of the configuration profile.